diff --git a/.bazelrc b/.bazelrc
index a2687b5aa77..97fce01b9e5 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -163,16 +163,13 @@ common:auto-release -c opt
 common:auto-release --@io_bazel_rules_go//go/config:pgoprofile=enterprise/tools/pgo:prod.pprof
 
 # Static build configuration. MacOS is currently unsupported.
-# On multi-user machines, specify HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX in your
-# repo_env in user.bazelrc to avoid permissions errors.
-common:static --repo_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+# common:static --repo_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 # Workaround for Bazel 7.
 # See https://github.com/uber/hermetic_cc_toolchain/releases/tag/v3.0.1 for more details
 common:static --sandbox_add_mount_pair=/tmp
-common:static --extra_toolchains=@zig_sdk//toolchain:linux_amd64_musl
-# arm64 is not yet tested, so we leave this toolchain commented out for now.
-# common:static --extra_toolchains=@zig_sdk//toolchain:linux_arm64_musl
+# common:static --extra_toolchains=@musl_toolchains_hub//:musl-1_2_3-platform-x86_64-unknown-linux-gnu-target-x86_64-linux-musl
 common:static --@io_bazel_rules_go//go/config:static=true
+common:static --linkopt=-Wl,-static
 common:static --copt=-fPIC
 
 # By default, build logs get sent to the production server
diff --git a/WORKSPACE b/WORKSPACE
index 8afbeaac79f..e3ef16e2665 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -479,23 +479,19 @@ rules_proto_dependencies()
 
 rules_proto_toolchains()
 
-HERMETIC_CC_TOOLCHAIN_VERSION = "v3.0.1"
-
 http_archive(
-    name = "hermetic_cc_toolchain",
-    sha256 = "3bc6ec127622fdceb4129cb06b6f7ab098c4d539124dde96a6318e7c32a53f7a",
-    urls = [
-        "https://mirror.bazel.build/github.com/uber/hermetic_cc_toolchain/releases/download/{0}/hermetic_cc_toolchain-{0}.tar.gz".format(HERMETIC_CC_TOOLCHAIN_VERSION),
-        "https://github.com/uber/hermetic_cc_toolchain/releases/download/{0}/hermetic_cc_toolchain-{0}.tar.gz".format(HERMETIC_CC_TOOLCHAIN_VERSION),
-    ],
+    name = "musl_toolchains",
+    sha256 = "f9f077b9ae74a0545f7cb7108462cb061593eef10fd09d25db4554e281ee880b",
+    url = "https://github.com/bazel-contrib/musl-toolchain/releases/download/v0.1.7/musl_toolchain-v0.1.7.tar.gz",
 )
 
-load("@hermetic_cc_toolchain//toolchain:defs.bzl", zig_toolchains = "toolchains")
+load("@musl_toolchains//:repositories.bzl", "load_musl_toolchains")
+
+load_musl_toolchains()
+
+load("@musl_toolchains//:toolchains.bzl", "register_musl_toolchains")
 
-# Plain zig_toolchains() will pick reasonable defaults. See
-# toolchain/defs.bzl:toolchains on how to change the Zig SDK version and
-# download URL.
-zig_toolchains()
+register_musl_toolchains()
 
 register_toolchains(
     "//toolchains:sh_toolchain",